diff options
Diffstat (limited to 'system/shadow')
| -rw-r--r-- | system/shadow/APKBUILD | 110 | ||||
| -rw-r--r-- | system/shadow/dots-in-usernames.patch | 11 | ||||
| -rw-r--r-- | system/shadow/login.pamd | 6 | ||||
| -rw-r--r-- | system/shadow/pam-useradd.patch | 9 | ||||
| -rw-r--r-- | system/shadow/useradd-usergroups.patch | 8 |
5 files changed, 144 insertions, 0 deletions
diff --git a/system/shadow/APKBUILD b/system/shadow/APKBUILD new file mode 100644 index 000000000..13dc98d7a --- /dev/null +++ b/system/shadow/APKBUILD @@ -0,0 +1,110 @@ +# Contributor: William Pitcock <nenolod@dereferenced.org> +# Contributor: Jakub Jirutka <jakub@jirutka.cz> +# Maintainer: Stuart Cardall <developer@it-offshore.co.uk> +pkgname=shadow +pkgver=4.5 +pkgrel=0 +pkgdesc="PAM-using login and passwd utilities (usermod, useradd, ...)" +url="http://pkg-shadow.alioth.debian.org/" +arch="all" +license="GPL" +depends="" +makedepends="linux-pam-dev" +subpackages="$pkgname-doc $pkgname-dbg $pkgname-uidmap" +source="https://github.com/shadow-maint/shadow/releases/download/$pkgver/shadow-$pkgver.tar.xz + login.pamd + dots-in-usernames.patch + useradd-usergroups.patch + pam-useradd.patch + " +# secfixes: +# 4.5-r0: +# - CVE-2017-12424 +# 4.2.1-r11: +# - CVE-2017-2616 +# 4.2.1-r7: +# - CVE-2016-6252 + +options="suid" +builddir="$srcdir/shadow-$pkgver" + +build() { + cd "$builddir" + + ./configure \ + --build=$CBUILD \ + --host=$CHOST \ + --target=$CTARGET \ + --prefix=/usr \ + --sysconfdir=/etc \ + --mandir=/usr/share/man \ + --infodir=/usr/share/info \ + --localstatedir=/var \ + --disable-nls \ + --with-libpam \ + --without-audit \ + --without-selinux \ + --without-acl \ + --without-attr \ + --without-tcb \ + --without-nscd \ + --without-group-name-max-length \ + || return 1 + make || return 1 +} + +check() { + cd "$builddir" + make check +} + +package() { + cd "$builddir" + + make DESTDIR="$pkgdir" install || return 1 + + # Do not install these pam.d files they are broken and outdated. + rm "$pkgdir"/etc/pam.d/* || return 1 + + # install some pam.d files based on a patched useradd + for pamf in groupadd groupdel groupmems groupmod \ + useradd userdel usermod + do + install -m0644 etc/pam.d/useradd \ + "$pkgdir/etc/pam.d/$pamf" || return 1 + done + # nologin is provided by util-linux. + rm "$pkgdir"/sbin/nologin || return 1 + + # However, install our own for login. + cp "$srcdir"/login.pamd "$pkgdir"/etc/pam.d/login || return 1 + + # /etc/login.defs is not very useful - replace it with an *almost* blank file. + rm "$pkgdir"/etc/login.defs + echo "USERGROUPS_ENAB yes" > "$pkgdir"/etc/login.defs + + # Avoid conflict with man-pages. + rm "$pkgdir"/usr/share/man/man3/getspnam.3* \ + "$pkgdir"/usr/share/man/man5/passwd.5* || return 1 +} + +uidmap() { + pkgdesc="Utilities for using subordinate UIDs and GIDs" + + mkdir -p "$subpkgdir" + cd "$subpkgdir" + + mkdir -p usr/bin + mv "$pkgdir"/usr/bin/new*idmap usr/bin/ || return 1 + chmod 4711 usr/bin/new*idmap || return 1 + + # Used e.g. for unprivileged LXC containers. + mkdir etc + touch etc/subuid etc/subgid +} + +sha512sums="e57f8db54df23301c229d4be30d4cbb67efa1d1809cffcff79adc480b6019fb2b5fd09e112e82a3f00ad5a6b2994592adac93f70a631cf666b6f4723b61c87b5 shadow-4.5.tar.xz +46a6f83f3698e101b58b8682852da749619412f75dfa85cecad03d0847f6c3dc452d984510db7094220e4570a0565b83b0556e16198ad894a3ec84b3e513d58d login.pamd +745eea04c054226feba165b635dbb8570b8a04537d41e914400a4c54633c3a9cf350da0aabfec754fb8cf3e58fc1c8cf597b895506312f19469071760c11f31d dots-in-usernames.patch +49f1d5ded82d2d479805c77d7cc6274c30233596e375b28306b31a33f8fbfc3611dbc77d606081b8300247908c267297dbb6c5d1a30d56095dda53c6a636fb56 useradd-usergroups.patch +0b4587e263cb6be12fa5ae6bc3b3fc4d3696dae355bc67d085dc58c52ff96edb4d163b95db2092b8c2f3310839430cac03c7af356641b42e24ee4aa6410f5cf1 pam-useradd.patch" diff --git a/system/shadow/dots-in-usernames.patch b/system/shadow/dots-in-usernames.patch new file mode 100644 index 000000000..b684c9d02 --- /dev/null +++ b/system/shadow/dots-in-usernames.patch @@ -0,0 +1,11 @@ +--- shadow-4.1.3/libmisc/chkname.c ++++ shadow-4.1.3/libmisc/chkname.c +@@ -66,6 +66,7 @@ + ( ('0' <= *name) && ('9' >= *name) ) || + ('_' == *name) || + ('-' == *name) || ++ ('.' == *name) || + ( ('$' == *name) && ('\0' == *(name + 1)) ) + )) { + return false; + diff --git a/system/shadow/login.pamd b/system/shadow/login.pamd new file mode 100644 index 000000000..ad4555809 --- /dev/null +++ b/system/shadow/login.pamd @@ -0,0 +1,6 @@ +# /bin/login opens an interactive session. + +auth include base-auth +account include base-account +password include base-password +session include base-session diff --git a/system/shadow/pam-useradd.patch b/system/shadow/pam-useradd.patch new file mode 100644 index 000000000..71a1bcd25 --- /dev/null +++ b/system/shadow/pam-useradd.patch @@ -0,0 +1,9 @@ +--- a/etc/pam.d/useradd ++++ b/etc/pam.d/useradd +@@ -1,4 +1,4 @@ + #%PAM-1.0 + auth sufficient pam_rootok.so +-account required pam_permit.so +-password include system-auth ++account include base-account ++password include base-password diff --git a/system/shadow/useradd-usergroups.patch b/system/shadow/useradd-usergroups.patch new file mode 100644 index 000000000..adf297231 --- /dev/null +++ b/system/shadow/useradd-usergroups.patch @@ -0,0 +1,8 @@ +--- a/etc/useradd ++++ b/etc/useradd +@@ -1,5 +1,4 @@ + # useradd defaults file +-GROUP=1000 + HOME=/home + INACTIVE=-1 + EXPIRE= |